Control A.8.11Data masking
Data masking must be used in accordance with the organisation’s topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration.
New in the 2022 edition. Masking, pseudonymisation and anonymisation reduce the exposure of information without removing the ability to work with it — for development and testing, for analytics, for support, and for displaying only part of a value to a user who needs to confirm it rather than read it.
The techniques differ in strength and in reversibility, and the distinction matters legally as well as technically: pseudonymised data is still personal data under the GDPR, anonymised data is not, and the boundary between them is where more claims are made than can be supported.
The connection to A.8.33’s test information is the most common application. Copying production data into a test environment is the failure this control addresses, and masking it properly — rather than obscuring it visibly while leaving it recoverable — is what determines whether the copy is still sensitive.
How to put this in place
Sensitive data often spreads into test systems, reports and support tools where fewer controls apply. Your ISMS needs those uses to show masked or reduced data, so a leak there does not expose real people or customers.
- Find where sensitive data is used beyond its main purpose.
- Choose a method for each case: masking, pseudonymisation, truncation or synthetic data.
- Apply it in the process that copies the data, not by hand afterwards.
- Check that the masking cannot easily be reversed, and limit who sees unmasked data.
- Re-check when data sources or fields change.
Evidence an auditor usually looks for: masking rules and where they apply, and a sample of test or reporting data showing the masking.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.